Is it possible to get a Linux coredump that only contains callstack, threads, and local variables?

Question

My company is utilizing the coredump functionality in Linux (CentOS specifically) to track down some hard to find issues. Unfortunately, we have a bunch of small VMs running with limited HD space and the full core dumps are causing issues because of the large amount of space taken up by the heaps.

Is it possible to just have Linux dump the callstack, threads and local variables when a segmentation fault occurs? I tried just limiting the dumps to 50 megs, but it doesn't seem like all the desired details are in that first 50 megabytes (ulimit -c 51200). We're okay truncating the heap like that, but I haven't been able to find out what size would work.

I know it's possible to write out your own callstack when desired with some extra code, but we're at the point where we're wrapping up and that'd be a hard sell for these last couple issues we're running into.

Answer 1

You can pipe core dumps to a program, and so write your own filter. Extract from man core

Since kernel 2.6.19, Linux supports an alternate syntax for the /proc/sys/kernel/core_pattern file. If the first character of this file is a pipe symbol (|), then the remainder of the line is interpreted as a program to be executed. Instead of being written to a disk file, the core dump is given as standard input to the program.

You can also control which mappings are written to the core dump, this maybe use to reduce the core dump size.

Since kernel 2.6.23, the Linux-specific /proc/PID/coredump_filter file can be used to control which memory segments are written to the core dump file

Of course, all these depends of kernel version and configuration options.

see the link I've provided for examples or details.